- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- China
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2023
- Sources
- 9 sources carry it
- Identifier
- GINC-APT-0073 · antique-typhoon
ChinaWhat it is
Storm-0558 is a China-based threat actor with espionage objectives. While there are some minimal overlaps with other Chinese groups such as Violet Typhoon (ZIRCONIUM, APT31), Microsoft maintain high confidence that Storm-0558 operates as its own distinct group
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Microsoft
- Storm-0558
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Germany, United States
- Sectors
- Government, Media, Telecommunications, Think Tanks
Tools
The tools and malware families the sources tie to it.
- China Chopper
- Minimo
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de